SideNotes 2.3.0

Internal, staff-only notes for Omeka Classic Items and Collections. This
release makes notes available through the Omeka API so scripts and external
tools can create and update them, and brings in the interface and reliability
work from 2.2.

Upgrading: replace the SideNotes folder in omeka/plugins/ with this
version, then go to Plugins → Upgrade next to Side Notes. There is no
schema change and existing notes are preserved.

Added

• Notes are available through the API at /api/side_notes (index, get,
  post, put, delete), for reading and writing notes programmatically.
• POST is an upsert. Send record_type, record_id and note; the note
  is created, or replaced if that record already has one. A record can only
  hold one note, so callers never need to check first. created and
  created_by_user_id survive an overwrite, keeping the audit trail intact.
• ?record_type= and ?record_id= filters on the index action.
• Pagination on the Notes browse page, following the admin
  "results per page" setting.
• Identifier column, showing the Dublin Core Identifier, or the record
  number (#150) where none is set — useful when records share a title.
• Batch delete: per-row checkboxes, select-all, and a "Delete Selected" bar.
• Inline editing: edit a note directly on the browse page without opening
  the Item or Collection.

Changed

• Admin UI follows the native Omeka admin theme: native table styling,
  sortable headers, section-nav tabs and action-links.
• Stored <br /> markup in note text is normalised to real line breaks
  wherever notes are displayed.

Fixed

• Deleting a note no longer lands on a 404. url() already includes the admin
  base path and the redirector prepended it again, producing
  /admin/admin/.... The redirect now returns to the notes list, preserving
  tab, sort order and page.

Security

• Notes declare an ACL resource, are denied to everyone by default, and are
  then granted to the super and admin roles.
• Omeka's API index action performs no per-record permission check — it
  returns whatever the table query yields (core hides private items the same
  way, by filtering inside the table). Table_SideNote::applySearchFilters
  enforces the check itself and fails closed, so an anonymous listing returns
  an empty set rather than every note.
• Verified against a live install: unauthenticated GET by id, POST and
  DELETE return 403, and an unauthenticated listing returns [].

Compatibility

• Omeka Classic 2.0+ (developed and tested against 3.2.1). Requires PHP 5.6+.

---

Full history: see CHANGELOG.md.

SideNotes 2.1.0

SideNotes 2.1.0

Internal, staff-only notes for Omeka Classic Items and Collections. This release rebuilds the admin interface to match Omeka's native admin theme and adds a real note-management workflow on top of the original 1.0.0 foundation, along with several bug and security fixes.

Upgrading: Replace the SideNotes folder in omeka/plugins/ with this version and go to Plugins → Upgrade next to Side Notes. Existing notes are preserved.

Added

• Dedicated Notes browse page (admin navigation → Notes) with separate Item Notes and Collection Notes tabs.
• Sortable columns for Created and Modified dates, using Omeka's native sort controls.
• Recent-notes dashboard panels for Items and Collections.
• Author and timestamp tracking — each note records who created and last edited it, and when.
• Working Delete action on the browse page (POST + CSRF-protected, with a confirmation prompt).
• Configuration options: note preview length, number of recent notes on the dashboard, and timestamp format.

Changed

• Admin UI now matches the native Omeka admin theme. The browse page uses Omeka's own table styling, sortable headers, section-nav tabs, and action-links; the dashboard and sidebar panels use the native panel / recent-row markup. Custom CSS was removed so the plugin inherits the active theme (no hardcoded colors).
• Server-side validation of configuration values (clamped to safe ranges; timestamp format restricted to the supported set).

Fixed

• Double-escaped record titles — titles containing characters like & displayed as & on the dashboard and browse page. Now escaped exactly once.
• Recent-notes dashboard query could fail because the row limit was bound as a string (LIMIT '10'). The limit is now applied correctly.

Security

• Delete requests require POST and a valid per-session CSRF token.
• Browse sorting uses a strict column/direction whitelist; all queries remain parameterized and all output is escaped.

Compatibility

• Omeka Classic 2.0+ (tested on 3.1.2). Requires PHP 5.6+.

Known follow-ups

See CODE_REVIEW.md for recommended next steps: role-based access control for the Notes page and delete, cleanup of orphaned notes when a record is deleted, and pagination for very large note sets.

---

Full changes: see CHANGELOG.md. Previous release: v1.0.0 (2025-07-25).

v1.0.0

Release Description
Here's a professional release description for your v1.0.0 release:
SideNotes Plugin v1.0.0 - Initial Release
New Features:
Add private, staff-only notes to Items and Collections in Omeka Classic admin interface
Sidebar integration displaying notes alongside Public/Featured panels
Edit form integration with dedicated textarea for note management
Dedicated database table storage ensuring notes never appear on public site
Automatic jQuery-powered positioning in admin sidebar
Full CRUD operations: create, read, update, and delete notes
Technical Details:
Compatible with Omeka Classic 2.x and later
Requires PHP 5.6+
Automatic database table creation on plugin installation
Clean uninstallation with table removal
Use Cases:
Curatorial reminders and internal documentation
Cataloging tips and workflow notes
Back-office commentary and staff communication
Private research notes and administrative records
This plugin enhances workflow efficiency by providing a dedicated space for internal notes without affecting the public-facing content.